USN-8526-1: libheif vulnerabilities

Xianrui Dong discovered that libheif had an out-of-bounds read in its HEIF sequence track parser. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. CVE-2026-47254 Junyi Liu discovered that libheif had...

PYSEC-2026-3207 Integer overflow in `SpaceToBatchND`

Impact The implementation of tf.rawops.SpaceToBatchND in all backends such as XLA and handwritten kernels is vulnerable to an integer overflow: python import tensorflow as tf input = tf.constant-3.5e+35, shape=10,19,22, dtype=tf.float32 blockshape = tf.constant-1879048192, shape=2, dtype=tf.int64...

PYSEC-2026-3344 Integer overflow in `SpaceToBatchND`

Impact The implementation of tf.rawops.SpaceToBatchND in all backends such as XLA and handwritten kernels is vulnerable to an integer overflow: python import tensorflow as tf input = tf.constant-3.5e+35, shape=10,19,22, dtype=tf.float32 blockshape = tf.constant-1879048192, shape=2, dtype=tf.int64...

PYSEC-2026-3160 Integer overflow in Tensorflow

Impact The implementation of OpLevelCostEstimator::CalculateTensorSize is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements: cc int64t OpLevelCostEstimator::CalculateTensorSize const OpInfo::TensorProperties&...

PYSEC-2026-3254 Integer overflow in Tensorflow

Impact The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements: cc for const auto& dim : outputshape.dim outputsize = dim.size; Here, we can have a...

PYSEC-2026-3090 Overflow and uncaught divide by zero in Tensorflow

Impact The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug: python import tensorflow as tf tf.rawops.UnravelIndexindices=-0x100000,dims=0x100000,0x100000 Patches We have patched the issue in GitHub commit 58b34c6c8250983948b5a781b426f6aa01fd47a...

PYSEC-2026-3232 Integer overflow in Tensorflow

Impact The implementation of Range suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. Patches We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 merging 51733. The fix will be included in...

PYSEC-2026-3151 Integer overflow in TFLite array creation

Impact An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate: cc TfLiteIntArray TfLiteIntArrayCreateint size int allocsize = TfLiteIntArrayGetSizeInBytessize; // ... TfLiteIntArray ret = TfLiteIntArraymallocallocsize; // ... The...

PYSEC-2026-3258 Integer overflow leading to crash in Tensorflow

Impact The implementation of SparseCountSparseOutput can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation: python import tensorflow as tf import numpy as np tf.rawops.SparseCountSparseOutput indices=1,1, values=2, denseshape=2 31, 2 32,...

PYSEC-2026-3240 Integer overflows in Tensorflow

Impact The implementations of SparseCwise ops are vulnerable to integer overflows. These can be used to trigger large allocations so, OOM based denial of service or CHECK-fails when building new TensorShape objects so, assert failures based denial of service: python import tensorflow as tf import...

PYSEC-2026-3114 Integer overflows in Tensorflow

Impact The implementation of AddManySparseToTensorsMap is vulnerable to an integer overflow which results in a CHECK-fail when building new TensorShape objects so, an assert failure based denial of service: python import tensorflow as tf import numpy as np tf.rawops.AddManySparseToTensorsMap...

PYSEC-2026-3137 Integer overflow in TensorFlow

Impact Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior. Patches We have patched the issue in GitHub commi...

PYSEC-2026-3159 Integer overflow in Tensorflow

Impact The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness: python import tensorflow as tf input = tf.constant1,1,dtype=tf.qint32 @tf.function def test: y = tf.rawops.Dequantize input=input, minrange=1.0, maxrange=10.0, mode='MINCOMBINED',...

Integer Overflow or Wraparound in OpenCV.

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 corresponding with OpenCV-Python 3.3.0....

PYSEC-2026-2825 Integer Overflow or Wraparound in OpenCV.

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 corresponding with OpenCV-Python 3.3.0....

PYSEC-2026-2832 Integer Overflow or Wraparound in OpenCV

In opencv/modules/imgcodecs/src/grfmtpxm.cpp, function PxMDecoder::readData has an integer overflow when calculate srcpitch. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 corresponding to OpenCV-Python 3.3.0.9 and earlier...

PYSEC-2026-2804 Integer Overflow or Wraparound in OpenCV

In opencv/modules/imgcodecs/src/grfmtpxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 corresponding with OpenCV-Python version 3.3.0.9 and...

OESA-2026-2976 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in...

OESA-2026-2974 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in...

OESA-2026-2973 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in...